One of the most common symptoms of a western digital hard drive head crash is the drive clicking a few times then spinning down. In most cases this is a sign that one or more of the read/write heads are failing. To recover the data from this type of failure it is very helpful to have a PC-3000.
This is a step by step how to using the PC-3000 for western digital data recovery with a hard drive clicking and spinning down.
Attach the western digital drive to the PC-3000 then wait for the drive to spin down. Open the PC-3000 software utility and select the corresponding drive family. Typically, this type of problem will apply to the western digital marvel drive families. Select “Marvel” from the list of WD hard drive families. When the utility opens the dialog box will indicate that the utility is in “Kernel” mode. This mode reads information about the drive from ROM. Select “Auto Detect” from the dialog box. This will detect the exact drive family of the drive.
One of the most common symptoms of a western digital hard drive head crash is the drive clicking a few times then spinning down. In most cases this is a sign that one or more of the read/write heads are failing. To recover the data from this type of failure it is very helpful to have a PC-3000. This is a step by step how to using the PC-3000 for western digital data recovery with a hard drive clicking and spinning down.
Attach the western digital drive to the PC-3000 then wait for the drive to spin down. Open the PC-3000 software utility and select the corresponding drive family. Typically, this type of problem will apply to the western digital marvel drive families. Select “Marvel” from the list of WD hard drive families. When the utility opens the dialog box will indicate that the utility is in “Kernel” mode. This mode reads information about the drive from ROM. Select “Auto Detect” from the dialog box. This will detect the exact drive family of the drive.
The utility will then read some basic information about the drive from the ROM, including a head map. You will see the head map information presented as “Heads Map” 0,1,2,3 etc.
After the utility completes reading the ROM based information and comes ready go to “Tests” located at the top of the utility menu. Then select work with RAM. An option “RAM Head Map Editing” will be presented, click on it.
A dialog box displaying the drive head map will be displayed. Here is where the editing comes into play. If any of the hard drive’s heads are failing to read, the drive will click and shut down. However, the drive can only be initialized by the first two heads, in this case either head 0 or 1. The first order of business will be to delete the current head map and see if we can initialize the drive with only one head turned on. We start with head 0, which is one of the two heads that can initialize the drive. So, in the dialog box we would type 0,0,0,0. You don’t have to worry about adding commas, the software will do that for you and it also will not allow you to input more heads than necessary. Now press F7 or the soft reset icon located on the right tool bar.
You will hear the drive spin up. Hopefully, you will hear or feel the drive initialize. You can check to see if the drive has come ready by pressing ALT-P or navigating to tools on the top menu bar and then selecting “Drive ID”. If the drive ID shows the full model, size and serial number of the drive, then the drive has initialized and come ready. If it does not, repeat the RAM head map editing replacing head 0 with head 1. Assuming the drive does come ready with either head 0 or 1, the next step is to go back and edit the RAM head map and enable all heads 0,1,2,3. Now we’re ready to do some Western Digital data recovery.
Western Digital Data Recovery Using Data Extractor
Now we will click on the “Windows” menu item. We will now select the “Data Extractor” program. When Data Extractor opens select “Start a New Task” and name the task. This is where any saved data will be stored should you choose to use the “Explorer Option”, but we will get to that later. A series of dialogs will appear will default options. We will assume the Western Digital drive is attached to PC-3000 ATA0 and your clone drive is attached to PC-3000 ATA1. Choose the source as ATA0, when prompted choose “Make a Binary Image”. When the task has read the drive ID and the drive mapping has completed it is now time to build a head map in Data Extractor. Click on the head map icon on the right tool bar or select it from the top menu. When the head map completes, it will take a few minutes, then we have to make decisions. We know we have a failing head but we do not yet know which of the heads has failed but we may have some clues. If while editing the head map in the PC-3000 utility head 0 did not initialize the drive but head 1 did, then we may want to disable head zero. Consequently, if head 0 initialized the drive then we may want to turn off head 1. Additionally, you can choose to try reading with just one head at a time. Eventually, the bad head or heads will be detected. If the drive looses readiness or times out, you will have to go back to the utility and repeat the RAM head map editing to initialize the drive. When you have found the culprit head(s) disable them and image with the working heads. If imaging with these heads turned off is working well, occasionally turn on the failing head to check if will read. In some cases, heads that are failing intermittently will work after the imaging process has been running for some time. This does not occur often but it does occur. If you have managed to image the entire drive with one head turned off you have done well. However, there will be data that has not been recovered. You will need to evaluate the data that has been recovered by opening files, looking at them with a hew editor etc. If the valued data has not been retrieved, unfortunately a head replacement will be necessary.
Western Digital head swap
You will need to find donor parts or a donor drive with similar micro-jog. It is helpful if you have a large number of donor heads to use as donors if you do not have a drive that has similar micro-jog. You may go through a few Western Digital head assemblies prior to finding one that the source drive will except as a donor even if they are of the same model. You will need to use Deepspar’s DDI or the PC-3000 to determine the exact micro-jog. Micro-jog reflects the information that was used to tune the drive at manufacturing. Information that is relative to the micro-jog is firmware ID, firmware release etc. It is worth noting that having a large inventory of hard drives is prudent. There are many sites including donordrives.com and mydonordrives.com that have the information necessary to match donor micro-jog. However, you will pay a premium for these parts. In some cases you may need multiple western digital donor drives if platter damage has occurred. If you do not have compatible Western Digital donor parts try to find a donor with similar firmware, date and manufacturing country of origin.
WD file system recovery and raw data recovery
If you are working on a windows based drive it is important to recover the Master File Table (MFT). If the drive has a single partition the MFT should start at LBA start 6291541 or somewhere close to that LBA. The boot sector could be 63 or 2048. If you were able to clone the first sector of the drive you can determine exactly where critical file system components are located. You can download the demo version of Winhex to begin the examination.
In the image above we used WinHex template viewer to look at the first sector as a Master Boot Record (MBR). We can see there is a small Dell diagnostic partition, followed by the larger NTFS partition. We can see the partition or operating system type in the Partition Type Indicator box: 07=NTFS and DE=Dell Diagnostic Partition. You can see in the NTFS partition that there are 80325 sectors preceding the partition. So, if we navigate to sector 80325 and view it in Win Hex’s template manager as an NTFS Boot Sector, we will be able to determine at what sector the Master File Table (MFT) begins.
The illustration above shows us that the Start Cluster of the MFT is located at cluster number 786432. We also see that there are 512 bytes per sector. There is 4k per cluster; therefore, to determine the LBA sector where the MFT starts we will multiply 786432 by 8. When we multiply 786432 by 8 we get LBA sector 6,291,456. We will then have to add to that number the amount of sectors preceding the NTFS partition which was 80325. Now we have determined that the MFT starts at LBA sector 6,371,781. If we navigate to that sector in Win Hex we will see the beginning of the Master File Table.
If the first few MFT entries are missed, they can usually be found in the MFT mirror which should be located at the 50% mark of the total storage of the Western Digital drive. If you are working with MAC HFS+ the beginning of the drive is very important. The catalog file is usually within the first one percent of the drive. In Data Extractor using the “Explorer” option you can scan for the catalog file. These are operating system components necessary to retrieve file names and directory structure. Failure to copy these sectors may result in partial file structure. However, you can use data recovery software such as R-Studio or Data Extractor to perform a forensic or RAW file scan by file types. The software will look for hexadecimal and other values that constitute the header value of a particular type of file. The files retrieved would not have the original file names and would be arbitrarily renamed followed by the file extender, example file1.jpg, file2.jpg. However, some of the file metadata and attributes may be intact which is useful for sorting files by date, title, etc. However, sorting raw files is more helpful with textual documents that house title and author information. Recently, Deepspar’s DDI 4 has added some of the functionality discussed.
Western Digital Encryption Data Recovery
Many of the Western Digital My Book external hard drives come with encryption that is based on a chip in the controller of the external enclosure. It is important to not discard or lose that enclosure while working on the Western Digital hard drive. However, if someone else has discarded the enclosure the lowest hanging fruit is to have an inventory of similar enclosures. You will need to make sure you are cloning the failed or clicking Western Digital drive to another Western Digital drive of the same size.
New versions of the PC-3000 do work with encryption of Western Digital My Book hard drives. Having a PC-3000 is very useful for Western Digital hard drive data recovery.
Western Digital Data recovery conclusion
Having a tool like the PC 3000 is very useful for data recovery purposes. Of course, if the drive is displaying the symptoms we discussed, clicking and spinning down, you could just perform a head swap. However, if the data of value is a single file, or specific documents or photos, there may be a chance to recover the data without a head swap by disabling a defective head and cloning the remainder of the hard drive. Using Win Hex or Data Extractor to view what you have cloned with a head turned off will provide you the information you may need to pinpoint areas of the hard drive that need to be cloned. Finally, if after a head swap, with known compatible heads, you find that the head that was disabled is still unable to read or reads intermittently, the platter surface may have become damaged by the faulty read write head impacting it. In the cases where platter damage has occurred and the platter surface can only be partially imaged or not imaged at all, a raw or forensic scan for file types may be helpful. MFT entries and other file system components may have resided on the platter surface that is damaged or unreadable; however, the data may have resided on another platter’s surface. A raw or forensic scan will be able to retrieve some of this data.
